Do I have a computer virus? Real signs vs. false alarms
This guide is for anyone who suspects they have a virus and wants to know if it is real before installing yet another program or calling a number that appeared on the screen. You will learn to recognize the real signs, scan and clean on your own, and know when it has become too big to handle alone.
How do you know if your computer has a virus?
By what the computer does without being asked. These signs point to malware (malicious software) or unwanted software:
- The browser’s home page or search engine changed on its own, and comes back even after you change it back.
- Browser extensions you did not install, often with generic names like “PDF Converter” or “Search Helper”.
- Ads on every site, including sites that normally have no ads, or tabs that open by themselves.
- Friends receive messages from you that you never sent, by email, on Facebook or on WhatsApp.
- Remote-control software you did not install, such as AnyDesk or TeamViewer.
- Antivirus that was turned off and will not turn back on, or Windows updates that fail with no explanation.
Which signs are usually a false alarm?
The most common signs that make people think they have a virus are usually something else:
- A browser window shouting “Your computer is infected” and showing a phone number. That is a web page, not a real scan. Windows and Microsoft never show a phone number in a virus alert. Do not call. Read the guide on the “tech support” scam.
- Notifications popping up in the corner of the screen saying “virus detected”, even when the browser is closed. These are usually notifications from a website you once allowed to send messages. It is annoying, but it is not a virus, and you turn it off in the browser settings.
- The computer is slow. The usual cause is an old disk, too little memory, or programs that start with the computer. There is a separate guide for that: Computer slow? Checks you can do yourself.
- The fan is loud. Usually dust or normal load, not a secret crypto miner.
| Sign | Real or false? | What to do | When to come to the lab |
|---|---|---|---|
| A window with a phone number and “your computer is infected” | Almost always a scam | Close the browser, do not call | If you already gave someone access |
| “Virus” notifications in the corner of the screen | Usually website notifications | Revoke the notification permission | Not needed |
| Home page and search engine change on their own | Real | Remove extensions, reset the browser, scan | If it comes back after a reset |
| Friends receive messages from you | Real, a hacked account | Change the password from another device | If you cannot get into the account |
| AnyDesk or TeamViewer you did not install | Real | Disconnect from the internet, remove it, change passwords | Right away, if your bank may have been exposed |
| Slow computer | Usually not a virus | Check the disk, memory and startup programs | If it is still slow after the checks |
How do you tell a real Windows alert from a fake one? A real Microsoft Defender alert comes from the Windows notification area, carries the name “Windows Security”, and opens the app that is already installed on your computer. It does not ask for payment, does not show a phone number, and does not ask you to download software. If in doubt, do not click the alert. Open “Windows Security” yourself from the Start menu and see what it says there.
How do you scan with Microsoft Defender?
With the offline scan, which runs before Windows starts and therefore also catches malware that hides while the system is running. Microsoft Defender is built into Windows 11, so there is nothing to install.
- Save whatever is open. The computer will restart.
- Click Start, type “Windows Security” and open it.
- Go to “Virus & threat protection”.
- Click “Scan options”.
- Choose “Microsoft Defender Antivirus (offline scan)” and click “Scan now”.
- The computer restarts into a scanning screen. Once it comes back up, the results are in “Windows Security” under “Protection history”.
The full instructions are on Microsoft’s page about Microsoft Defender Offline. If you do not want to restart right now, you can start with a “Full scan” from the same screen. It checks every file and can take a long time.
How do you clean the browser?
Remove extensions you do not recognize, revoke website notifications, and if needed reset the browser. Here are the addresses to type in the address bar:
- Extensions: in Chrome
chrome://extensions, in Edgeedge://extensions. Remove every extension you do not recognize or do not remember installing. - Website notifications: in Chrome
chrome://settings/content/notifications, in Edgeedge://settings/content/notifications. Delete every site in the “Allowed” list that you do not know. - Search engine: in Chrome
chrome://settings/searchEngines. Make sure the default engine is the one you chose, and delete engines you do not recognize. - Reset: in Chrome
chrome://settings/reset, in Edgeedge://settings/reset. The reset restores the home page and search engine to their defaults and turns off extensions. Your bookmarks and saved passwords stay.
If an extension comes back after you removed it, there is probably a program on the computer that reinstalls it. Check the list of installed apps, as in the next section.
How do you check if someone is connecting to your computer remotely?
Check the list of installed apps and look for remote-control software you did not install yourself.
- Open Settings > Apps > Installed apps.
- Sort by install date and look for names like AnyDesk, TeamViewer, UltraViewer or RustDesk.
- If such a program is there and you do not remember installing it, or you installed it at the request of a “representative” who called you: disconnect the computer from the internet, remove it, and continue to the passwords section.
These programs are legitimate when you install them for a technician you know. The problem starts when someone else asked you to install them.
When should you change passwords, and from which device?
Right away, if there is any sign that an account was hacked or that someone connected to the computer, and from another device, for example your phone. If there is software on the computer that records keystrokes, a new password typed on it goes straight to the attacker.
- Email first. Through it, everything else can be reset.
- Bank and credit cards. If you typed in details while someone was connected, call the bank.
- Social networks and WhatsApp. In WhatsApp, turn on two-step verification in the account settings.
- Turn on two-factor authentication (2FA) on every account that offers it. An authenticator app is better than SMS, and SMS is better than nothing.
How did the malware get in to begin with?
In most cases someone ran it without knowing, not a “virus that flew in through the air”. It is worth thinking back to what changed before the signs started:
- A “free” program or game downloaded from an unofficial site, including cracked versions. Such installers often bundle extra programs.
- A misleading “Download” button on a download site, which installed something other than what you were looking for.
- An email attachment that looked like an invoice, a delivery notice or a fine.
- A website that asked you to “allow notifications” to watch a video or keep reading.
- A “support representative” who called and asked you to install software.
If you know what it was, remove that program first, and only then scan. That way the cleanup is not undone the next time the computer starts. And from now on: download software only from the maker’s website or from the Microsoft Store, and read every screen of the installer before clicking “Next”.
What not to do
- Do not call the number in a pop-up window, and do not give remote access to anyone who called you.
- Do not download a “cleaner” from an ad. Some of them are the unwanted software.
- Do not install three antivirus programs at once. They interfere with each other and do not protect you more.
- Do not keep working on Windows 10 without updates. Microsoft ended regular support for Windows 10 on 14 October 2025. A computer that is not enrolled in the Extended Security Updates (ESU) program no longer gets security updates.
When to bring the computer to the lab
Stop trying on your own if any of these is true:
- The scan found something and could not remove it, or Defender will not turn on at all.
- An extension, ads or the home page come back even after resetting the browser.
- A stranger connected to the computer remotely, especially if you were logged into your bank at the time.
- A message appeared saying your files are encrypted and demanding a ransom. That is a completely different situation, and it has its own guide: I got a ransom note, what do I do.
Did it not work?
The goal of this guide is for you to check and clean on your own, and in most cases of a “dirty” browser that is possible. If the problem keeps coming back, ChipLab in Haifa handles computer virus removal: we start with a diagnosis, you get a price before we begin, and at the end a short explanation of what caused the problem and how to avoid it.